CADO.CONF(5)

✨ cado.conf — the tea ☕

okay so bestie, welcome to CADO.CONF(5), from the File Formats Manual section 💖 this is the glow-up guide for the config file of Capability Ambient DO — yes that's what "cado" stands for, iconic name, no notes 💅

---

🌸 NAME 🌸

cado.conf — the Capability Ambient DO configuration file 🎀

---

🦋 DESCRIPTION 🦋

so like, the file /etc/cado.conf is the whole vibe check for deciding which ambient capabilities cado is allowed to hand out to users 👑

and here's the slay part: cado reads that file using the capability cap_dac_read_search, which means this config file does not need to be readable by users. privacy queen behavior fr fr 🫶

all lines that start with the sign # are comments. yep, that's it, that's the whole rule 💬

---

🧚 the syntax, bestie

non-comment lines look like this:

list_of_capabilities: list_of_users_and_groups

or, if you're feeling extra:

list_of_capabilities: list_of_users_and_groups: list_of_auth_commands

both list_of_capabilities and list_of_users_and_groups are comma separated lists of identifiers. commas are the moment ✨

---

👑 what goes in list_of_capabilities

items are capability names or capability masks (hexadecimal numbers). and for brevity, the cap_ prefix of a capability name can be totally skipped — like, net_admin and cap_net_admin mean the exact same thing. same energy, shorter name, we love efficiency 💅

---

🍓 what goes in list_of_users_and_groups

items are usernames or groupnames. and heads up: groupnames must be prefixed by @. don't forget the @ or it's giving chaos 😭

---

🔥 what goes in list_of_auth_commands

it's a command, or a list of commands separated by semicolon (;). if it's there, cado runs that whole sequence of commands, and it grants the capabilities defined in the current line only if all of them return zero as their exit status. all of them. zero. no exceptions. zero means yes, anything else means absolutely not 🙈

---

⭐ example of a cado.conf file

here's what it actually looks like, screenshot-worthy honestly:

# Capability Ambient DO configuration file
# cado.conf

net_admin: @netadmin,renzo: /usr/bin/logger cado net_admin $USER; /bin/echo OK
net_admin: @privatenet: /usr/local/lib/cado_autorize_privatenet
net_admin,net_bind_service,net_raw,net_broadcast: @vxvdex
cap_kill: renzo

so let's break this down because it ate 💖

in this example, renzo's processes can be granted (by cado) cap_net_admin and cap_kill. cap_net_admin can be acquired by processes owned by users belonging to the netadmin group. and users in vxvdex can provide their processes with a subset of cap_net_admin, cap_net_bind_service, cap_net_raw and cap_net_broadcast 🌈

---

🎀 SEE ALSO 🎀

• cado(1)
• caprint(1)
• capabilities(7)

---

okay that's the whole page bestie, go forth and configure responsibly 🫶

VirtualSquare Labs · June 23, 2016 · and yeah, it's the CADO.CONF(5) page, mwah 💋 periodt ✨